CVE-2020-13936

{"id": "CVE-2020-13936", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-03-10T08:15:14.103", "references": [{"url": "http://www.openwall.com/lists/oss-security/2021/03/10/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4%40%3Cdev.santuario.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9%40%3Cdev.ws.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad%40%3Cdev.ws.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da%40%3Cdev.ws.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6%40%3Cannounce.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245%40%3Cdev.ws.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7%40%3Ccommits.turbine.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340%40%3Cdev.ws.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd%40%3Ccommits.druid.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058%40%3Cdev.ws.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726%40%3Cdev.ws.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c%40%3Cdev.ws.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7%40%3Cdev.ws.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436%40%3Cdev.ws.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://security.gentoo.org/glsa/202107-52", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "tags": ["Patch", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://www.oracle.com/security-alerts/cpujan2022.html", "tags": ["Patch", "Third Party Advisory"], "source": "security@apache.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2."}, {"lang": "es", "value": "Un atacante que es capaz de modificar las plantillas de Velocity puede ejecutar c\u00f3digo Java arbitrario o ejecutar comandos de sistema arbitrarios con los mismos privilegios que la cuenta que ejecuta el contenedor Servlet. Esto se aplica a las aplicaciones que permiten a usuarios no confiables cargar y modificar plantillas de velocidad que ejecutan versiones de Apache Velocity Engine versiones hasta la 2.2"}], "lastModified": "2023-11-07T03:17:00.893", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:velocity_engine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE517B12-7101-4325-9037-A0839126C725", "versionEndExcluding": "2.3"}, {"criteria": "cpe:2.3:a:apache:wss4j:2.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F17078E-4D83-49E7-99CE-5174C073DD68"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.12.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F834ACC-D65B-4CA3-91F1-415CBC6077E2"}, {"criteria": "cpe:2.3:a:oracle:banking_enterprise_default_management:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0445461D-21F4-4744-91E3-A92C673E947D", "versionEndIncluding": "2.4.1", "versionStartIncluding": "2.3.0"}, {"criteria": "cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E60C0966-BF0D-4D18-B09B-5D0BB96DBFF3"}, {"criteria": "cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "473749BD-267E-480F-8E7F-C762702DB66E"}, {"criteria": "cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74C7E2F1-17FC-4322-A5C3-F7EB612BA4F5"}, {"criteria": "cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "320D36DA-D99F-4149-B582-3F4AB2F41A1B"}, {"criteria": "cpe:2.3:a:oracle:banking_loans_servicing:2.12.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E502A46-BAF4-4558-BC8F-9F014A2FB26A"}, {"criteria": "cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C542DC5E-6657-4178-9C69-46FD3C187D56"}, {"criteria": "cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D0F559E-0790-461B-ACED-5B00F4D40893", "versionEndIncluding": "2.4.1", "versionStartIncluding": "2.3.0"}, {"criteria": "cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "132CE62A-FBFC-4001-81EC-35D81F73AF48"}, {"criteria": "cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "645AA3D1-C8B5-4CD2-8ACE-31541FA267F0"}, {"criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4479F76A-4B67-41CC-98C7-C76B81050F8E"}, {"criteria": "cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B21E6EEF-2AB7-4E96-B092-1F49D11B4175"}, {"criteria": "cpe:2.3:a:oracle:hospitality_token_proxy_service:19.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7D45E2D-241B-4839-B255-A81107BF94BF"}, {"criteria": "cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD311C33-A309-44D5-BBFB-539D72C7F8C4"}, {"criteria": "cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38E74E68-7F19-4EF3-AC00-3C249EAAA39E"}, {"criteria": "cpe:2.3:a:oracle:retail_service_backbone:19.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DA6B655-A445-42E5-B6D9-70AB1C04774A"}, {"criteria": "cpe:2.3:a:oracle:retail_xstore_office_cloud_service:16.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DEDDCE7-7763-4F8B-AB25-EC3D8899303A"}, {"criteria": "cpe:2.3:a:oracle:retail_xstore_office_cloud_service:17.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45F95965-9958-4F05-819D-C59FAE2E1D4E"}, {"criteria": "cpe:2.3:a:oracle:retail_xstore_office_cloud_service:18.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7E4D2EE-7439-4958-9503-9A3974DC86D0"}, {"criteria": "cpe:2.3:a:oracle:retail_xstore_office_cloud_service:19.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8F03331-16D3-440F-9577-D2A7835F7638"}, {"criteria": "cpe:2.3:a:oracle:retail_xstore_office_cloud_service:20.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E6216CE-BB56-4996-B6C1-D461EEFD496E"}, {"criteria": "cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3ED272C-A545-4F8C-86C0-2736B3F2DCAF"}, {"criteria": "cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5B4C338-11E1-4235-9D5A-960B2711AC39"}, {"criteria": "cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C93F84E-9680-44EF-8656-D27440B51698"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}